<html>
<head><meta charset="utf-8"><title>triggering UB with pinned generators · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html">triggering UB with pinned generators</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="168522451"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168522451" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168522451">(Jun 19 2019 at 16:35)</a>:</h4>
<p>Does anyone have an easy example of a generator that will trigger Miri due to an improper usage of <code>Pin</code>? </p>
<p>I think I have some code that I think is using <code>Pin::new_unchecked</code> incorrectly, but Miri reports it as clean. I think that if I can get a generator that definitely uses self-references it will though.</p>



<a name="168523326"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168523326" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168523326">(Jun 19 2019 at 16:47)</a>:</h4>
<p>Any generator which maintains internal references during execution?</p>



<a name="168523329"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168523329" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168523329">(Jun 19 2019 at 16:47)</a>:</h4>
<p>between yield points?</p>



<a name="168524632"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168524632" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168524632">(Jun 19 2019 at 17:01)</a>:</h4>
<p>yeah you have to actually get the code to access bad memory in the wrong way</p>



<a name="168541716"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168541716" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168541716">(Jun 19 2019 at 20:14)</a>:</h4>
<p>Trying the simple thing gives a compiler error; do I actually need to use raw pointers?</p>
<div class="codehilite"><pre><span></span><span class="w">    </span><span class="k">move</span><span class="w"> </span><span class="o">||</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">        </span><span class="kd">let</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">num</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mi">0</span><span class="p">;</span><span class="w"></span>
<span class="w">        </span><span class="kd">let</span><span class="w"> </span><span class="n">num</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">num</span><span class="p">;</span><span class="w"></span>

<span class="w">        </span><span class="kr">yield</span><span class="w"> </span><span class="o">*</span><span class="n">num</span><span class="p">;</span><span class="w"></span>
<span class="w">        </span><span class="o">*</span><span class="n">num</span><span class="w"> </span><span class="o">+=</span><span class="w"> </span><span class="mi">1</span><span class="p">;</span><span class="w"></span>

<span class="w">        </span><span class="kr">yield</span><span class="w"> </span><span class="o">*</span><span class="n">num</span><span class="p">;</span><span class="w"></span>
<span class="w">        </span><span class="o">*</span><span class="n">num</span><span class="w"> </span><span class="o">+=</span><span class="w"> </span><span class="mi">1</span><span class="p">;</span><span class="w"></span>

<span class="w">        </span><span class="kr">yield</span><span class="w"> </span><span class="o">*</span><span class="n">num</span><span class="p">;</span><span class="w"></span>
<span class="w">        </span><span class="o">*</span><span class="n">num</span><span class="w"> </span><span class="o">+=</span><span class="w"> </span><span class="mi">1</span><span class="p">;</span><span class="w"></span>
<span class="w">    </span><span class="p">}</span><span class="w"></span>
</pre></div>


<div class="codehilite"><pre><span></span>error[E0626]: borrow may still be in use when generator yields
  --&gt; src/main.rs:11:19
   |
11 |         let num = &amp;mut num;
   |                   ^^^^^^^^
12 |
13 |         yield *num;
   |         ---------- possible yield occurs here
</pre></div>



<a name="168544188"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168544188" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168544188">(Jun 19 2019 at 20:46)</a>:</h4>
<p>probably there's some unstable feature flag to enable this?</p>



<a name="168562893"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168562893" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168562893">(Jun 20 2019 at 02:58)</a>:</h4>
<p>That would be cool, but finding a feature flag can be annoying. I like it when the compiler tells me :-)</p>



<a name="168572619"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168572619" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168572619">(Jun 20 2019 at 07:25)</a>:</h4>
<p>or maybe it only works for futures? that seems weird though.<br>
Cc <span class="user-mention" data-user-id="127859">@Taylor Cramer</span> <span class="user-mention" data-user-id="116883">@tmandry</span></p>



<a name="168650182"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168650182" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> tmandry <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168650182">(Jun 21 2019 at 02:17)</a>:</h4>
<p>I think you would need to make an immovable generator (i.e. <code>static move || { ... }</code>), resume it with <code>Pin::new_unchecked</code>, <em>move it</em>, and then resume it again</p>



<a name="168660977"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168660977" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168660977">(Jun 21 2019 at 07:11)</a>:</h4>
<p><code>static move ||</code> is the key to make an immovable generator closure?</p>



<a name="168660983"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168660983" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168660983">(Jun 21 2019 at 07:11)</a>:</h4>
<p>is there something similar for top-level functions?</p>



<a name="168708362"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168708362" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168708362">(Jun 21 2019 at 19:15)</a>:</h4>
<p><span class="user-mention" data-user-id="116883">@tmandry</span> perfect, thank you! <a href="https://play.rust-lang.org/?version=nightly&amp;mode=debug&amp;edition=2018&amp;gist=fab901d66e7fe118a48dfd4e9daa1669" target="_blank" title="https://play.rust-lang.org/?version=nightly&amp;mode=debug&amp;edition=2018&amp;gist=fab901d66e7fe118a48dfd4e9daa1669">this now trips up Miri correctly</a></p>



<a name="168708546"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168708546" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168708546">(Jun 21 2019 at 19:17)</a>:</h4>
<p>TL;DR: I wrote some incorrect unsafe code for generators years ago. I moved it to <code>Pin</code> and that made me realize that it was broken; I just wanted to "prove" it via Miri</p>



<a name="168708648"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168708648" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168708648">(Jun 21 2019 at 19:18)</a>:</h4>
<p>I guess there's not an easy way to adapt a generator to an iterator <em>without</em> something like <code>Box::pin</code> because there's no way to prevent moving the iterator</p>



<a name="168708666"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168708666" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168708666">(Jun 21 2019 at 19:18)</a>:</h4>
<p><span class="user-mention" data-user-id="116155">@Jake Goulding</span> thanks for that testcase :D</p>



<a name="168708724"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168708724" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168708724">(Jun 21 2019 at 19:19)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> NP. I'm sure it can be made smaller as I wasn't going for minimal</p>



<a name="168708733"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168708733" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168708733">(Jun 21 2019 at 19:19)</a>:</h4>
<p><em>shrug</em> fine for me</p>



<a name="168709863"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168709863" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168709863">(Jun 21 2019 at 19:33)</a>:</h4>
<p>hm, unfortunately your generator test errors even if you dont break the pinning^^</p>



<a name="168709941"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168709941" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168709941">(Jun 21 2019 at 19:34)</a>:</h4>
<p>looks like a stacked borrows violation somewhere in the genrator stuff...</p>



<a name="168710019"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168710019" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168710019">(Jun 21 2019 at 19:35)</a>:</h4>
<p>ah I guess it's not too surprising, you are creating a new mutable ref each time</p>



<a name="168710131"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168710131" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168710131">(Jun 21 2019 at 19:37)</a>:</h4>
<p><span class="user-mention" data-user-id="116155">@Jake Goulding</span> here's a better example: <a href="https://play.rust-lang.org/?version=nightly&amp;mode=debug&amp;edition=2018&amp;gist=7c961f8815370ae5aa4d2674d5b99def" target="_blank" title="https://play.rust-lang.org/?version=nightly&amp;mode=debug&amp;edition=2018&amp;gist=7c961f8815370ae5aa4d2674d5b99def">https://play.rust-lang.org/?version=nightly&amp;mode=debug&amp;edition=2018&amp;gist=7c961f8815370ae5aa4d2674d5b99def</a></p>



<a name="168710906"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168710906" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168710906">(Jun 21 2019 at 19:48)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> I’m not following what you mean by “creating a new mutable ref each time”. You mean via <code>let me = unsafe { Pin::new_unchecked(&amp;mut self.0) };</code> ? Other than breaking the guarantee of <code>Pin</code>, how is that bad?</p>



<a name="168711016"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168711016" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168711016">(Jun 21 2019 at 19:50)</a>:</h4>
<p>it breaks (one version of) the notion that a mutable reference is unique</p>



<a name="168711043"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168711043" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168711043">(Jun 21 2019 at 19:50)</a>:</h4>
<p>so it's basically the same as</p>
<div class="codehilite"><pre><span></span><span class="kd">let</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">local</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mi">0</span><span class="p">;</span><span class="w"></span>
<span class="kd">let</span><span class="w"> </span><span class="n">raw</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">local</span><span class="w"> </span><span class="k">as</span><span class="w"> </span><span class="o">*</span><span class="k">mut</span><span class="w"> </span><span class="n">_</span><span class="p">;</span><span class="w"></span>
<span class="kd">let</span><span class="w"> </span><span class="n">mut_ref</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">local</span><span class="p">;</span><span class="w"></span>
<span class="kd">let</span><span class="w"> </span><span class="n">_val</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="o">*</span><span class="n">raw</span><span class="p">;</span><span class="w"> </span><span class="c1">// UB! You violated aliasing rules.</span>
</pre></div>



<a name="168711092"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168711092" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168711092">(Jun 21 2019 at 19:51)</a>:</h4>
<p>also see <a href="https://github.com/rust-lang/unsafe-code-guidelines/issues/148" target="_blank" title="https://github.com/rust-lang/unsafe-code-guidelines/issues/148">https://github.com/rust-lang/unsafe-code-guidelines/issues/148</a></p>



<a name="168711426"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168711426" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168711426">(Jun 21 2019 at 19:56)</a>:</h4>
<p>I’m gonna think on it a bit, but until I have my “aha!” moment…</p>
<p><a href="https://play.rust-lang.org/?version=nightly&amp;mode=debug&amp;edition=2018&amp;gist=ecc91dd563bf653df42c6a40530d5d69" target="_blank" title="https://play.rust-lang.org/?version=nightly&amp;mode=debug&amp;edition=2018&amp;gist=ecc91dd563bf653df42c6a40530d5d69">This is how I would have “fixed” it</a>, but Miri still complains; is this the point you are talking about?</p>



<a name="168711442"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168711442" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168711442">(Jun 21 2019 at 19:56)</a>:</h4>
<p>yes</p>



<a name="168711462"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168711462" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168711462">(Jun 21 2019 at 19:57)</a>:</h4>
<p>my "better example" shows an error that does not come from stacked borrows. dangling pointer is more fundamental and there's nothing to discuss there.</p>



<a name="168711476"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168711476" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168711476">(Jun 21 2019 at 19:57)</a>:</h4>
<p>so that better demonstrates that your original code was wrong</p>



<a name="168711580"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168711580" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168711580">(Jun 21 2019 at 19:58)</a>:</h4>
<p>but even correct self-referential generators currently fail to run in Miri (without <code>-Zmiri-disable-validation</code>), and that's a deep-rooted incompatibility between (the current approach to) self-referential generators and (the current version of) Stacked Borrows</p>



<a name="168711747"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168711747" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168711747">(Jun 21 2019 at 20:00)</a>:</h4>
<p>Oh. Then <a href="https://play.rust-lang.org/?version=nightly&amp;mode=debug&amp;edition=2018&amp;gist=6dd3d73eee7a58e40ebabcb9240e4074" target="_blank" title="https://play.rust-lang.org/?version=nightly&amp;mode=debug&amp;edition=2018&amp;gist=6dd3d73eee7a58e40ebabcb9240e4074">this version with no unsafe code</a> that triggers Miri might actually be OK…?</p>



<a name="168713271"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168713271" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168713271">(Jun 21 2019 at 20:21)</a>:</h4>
<p>it better be, with no unsafe code :P</p>



<a name="168713395"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168713395" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168713395">(Jun 21 2019 at 20:23)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> I know I’m not telling you anything new, but false positives for a tool like Miri are really bad for trustworthiness for such a tool.</p>



<a name="168713419"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168713419" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168713419">(Jun 21 2019 at 20:23)</a>:</h4>
<p>If possible, it’d be wonderful to say “this error may not be valid due to …”</p>



<a name="168713509"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168713509" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168713509">(Jun 21 2019 at 20:24)</a>:</h4>
<p>well we are in the exploratory phase of both Miri and Stacked Borrows. not sure what to do about that.^^</p>



<a name="168713572"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168713572" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168713572">(Jun 21 2019 at 20:25)</a>:</h4>
<p>but I'll add to the "redo our error messages" task that it would be a good idea to distinguish "certain" from "less certain" UB errors</p>



<a name="168713589"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168713589" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168713589">(Jun 21 2019 at 20:26)</a>:</h4>
<p>that will not be 100% reliable but it might help in situations like this</p>



<a name="168713626"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168713626" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168713626">(Jun 21 2019 at 20:26)</a>:</h4>
<p>My worry is that during that phase, people might try to run Miri, see an error, then be told “oh that’s not a real error”. They internalize that and then in 3 years when we are past that stage they still think “Miri isn’t always right”</p>



<a name="168713711"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168713711" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168713711">(Jun 21 2019 at 20:27)</a>:</h4>
<p>const generics is a recent example of an “easy” way out of this:</p>
<blockquote>
<p>warning: the feature <code>const_generics</code> is incomplete and may cause the compiler to crash</p>
</blockquote>
<p>Could Miri say something equivalent?</p>



<a name="168713742"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168713742" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168713742">(Jun 21 2019 at 20:27)</a>:</h4>
<p>it says that in its README^^</p>



<a name="168713830"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168713830" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168713830">(Jun 21 2019 at 20:28)</a>:</h4>
<p>I know that false positives are a problem. Not long ago you also warned me about false negatives. I'm afraid avoiding both is not going to be possible until we have a precise and complete spec, and part of the job of Miri is to help figuring out that spec. ;)</p>



<a name="168714084"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168714084" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168714084">(Jun 21 2019 at 20:31)</a>:</h4>
<p>I share your worry though</p>



<a name="168714212"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168714212" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168714212">(Jun 21 2019 at 20:33)</a>:</h4>
<p>I planned anyway to print next to the error some text saying whether this is UB or an operation not supported by Miri. So now I think it should say "definite UB" or "might be UB, this is experimental" or "unsupported"</p>



<a name="168714339"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168714339" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168714339">(Jun 21 2019 at 20:35)</a>:</h4>
<p>I mean, the compiler doesn’t always avoid all false {negatives,positives} so you don’t have to be perfect.</p>
<blockquote>
<p>README</p>
</blockquote>
<p>(a) Who reads that <span aria-label="upside down" class="emoji emoji-1f643" role="img" title="upside down">:upside_down:</span>  (b) My main usage of Miri is via the playground’s button (and I just assume that’s true for everyone) so I was thinking in the output would be more obvious</p>
<blockquote>
<p>So now I think it should say</p>
</blockquote>
<p>That would be wonderful</p>



<a name="168714477"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168714477" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168714477">(Jun 21 2019 at 20:36)</a>:</h4>
<p>great, now I just need to find that time machine that lets me actually implement this :D</p>



<a name="168714508"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168714508" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168714508">(Jun 21 2019 at 20:37)</a>:</h4>
<p>currently just keeping Miri working (plus reviews etc) sucks up all my Rust time -- but that's also because of an approaching paper deadline</p>



<a name="168751177"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering%20UB%20with%20pinned%20generators/near/168751177" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/triggering.20UB.20with.20pinned.20generators.html#168751177">(Jun 22 2019 at 13:23)</a>:</h4>
<p>I think that cloning yourself is probably the more realistic solution :-)</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>